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DETAILED ACTION 
Claim Rejections - 35 USC § 103 

1 . The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

This application currently names joint inventors. In considering patentability of 

the claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of 

the various claims was commonly owned at the time any inventions covered therein 

were made absent any evidence to the contrary. Applicant is advised of the obligation 

under 37 CFR 1 .56 to point out the inventor and invention dates of each claim that was 

not commonly owned at the time a later invention was made in order for the examiner to 

consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 

prior art under 35 U.S.C. 103(a). 

2. Claims 1-5 and 21-25 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Ayi et al. (hereinafter "Ayi", Pub. No.: US 2002/0143735) in view of Hart 
(5,787,428). 

As per claim 1 , Ayi teaches a method for managing access to data in a database 
subject to a plurality of label-based security policies, the method comprising the steps 
of: 
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receiving, within a database management system, a request for performing an 
operation set of one or more operations on data in a table of the database (Ayi, page 1 , 
[0006] - [0008]); 

determining which policies, of the plurality of label-based policies, apply to the 
table based on a policy set of one or more policies associated with the table(Ayi, page 
1;[0006] [0008]). 

Ayi discloses determining whether to perform an operation/access on a dataset 
based on the label associated with the dataset (Ayi, page 1, [0006]). 

Ayi does not explicitly disclose whether to perform the operation on a row, of the 
table. Hart teaches determining whether to perform the operation on a row of the table 
based on a set of labels associated with the row (Hart, Fig. 4-8, col. 6, lines 5-19). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to modify the access control system of Ayi by incorporating 
determining whether to perform the operation on a row of the table based on a set of 
labels associated with the row as disclosed by Hart (Hart, Fig. 4-8, col. 6, lines 5-19). 
The motivation being to provide different security level and access management for 
different rows in the table. 
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As per claim 2, Ayi and Hart teach all the claimed subject matters as discussed in 
claim 1 , and further teach adding a policy column to the table for each policy in the 
policy set associated with the table (Hart, Fig. 4). 

As per claim 3, Ayi and Hart teach all the claimed subject matters as discussed in 
claim 2, and further teach storing a label, of the set of labels associated with the row, in 
a corresponding policy column of the row (Hart, Fig. 4). 

As per claim 4, Ayi and Hart teach all the claimed subject matters as discussed in 
claim 2, and further teach said step of determining which policies apply further 
comprising the step of determining whether a column is a policy column (Hart, Fig. 4-8, 
col. 6, lines 5-19). 

As per claim 5, Ayi and Hart teach all the claimed subject matters as discussed in 
claim 1 , and further teach the policy set associated with the table includes two or more 
policies of the plurality of label-based policies (Ayi, page 1 , [0006]-[0008], Hart, Fig. 
4-8). 

Claims 21-25 are rejected on grounds corresponding to the reasons given above 
for claims 1-5. 
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3. Claims 6-20 and 26-40 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Hayman et al. (hereinafter "Hayman", 5,859,966) in view of Ayi et al. 
(hereinafter "Ayi", Pub. No.: US 2002/0143735 A1). 

As per claim 6, Hayman discloses a method for managing access to data in on a 
policy set of one or more label-based security policies, the method comprising the steps 
of: 

registering one or more packages of routines, wherein each package of said one 
or more packages implements a security model that supports a model set of one or 
more policies of the policy set and said each package includes an access mediation 
routine (Hayman, col. 8, line 67 col. 9, line 14, col. 9, line 56 - col. 10, line 4, Hayman 
teaches incorporate and installation security software which inherently includes 
registering one or more package of routines, furthermore, applicant admits that 
registering one or more packages of routines are well known in the art, please see 
specification, page 17, 2nd to last line - page 18, line 2); 

associating a first policy of a first model set in a first package with an object 
(Hayman, col. 5, lines 18-60, Hayman teaches labels/policies are applied to each 
object. Please note the labels are plural, which inherently includes a first policy, a 
second policy, etc); and 

invoking the access mediation routine in the first package to determining whether 
to allow operation on data based on the first policy (Hayman, col. 3, line 44 - col. 4, line 
50, col. 9, line 55 - col. 10, line 4). 
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Hayman teaches the security policy is applied to an object, however, Hayman 
does not explicitly disclose the object is a first table within the database system. Ayi 
teaches applies labels to tables in the database system (Ayi, page 1, [0006]-[0008]). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to modify the security system of Hayman by applying the 
labels/policies to tables in the database system as disclosed by Ayi. The motivation 
being to control access to the data in a table of the database system. 

As per claim 7, Hayman and Ayi teach all the claimed subject matters as 
discussed in claim 6, and further teach forming said each package of said one or more 
packages so that the access mediation routine conforms to a specified interface for 
enforcing a policy in the database management system (Hayman, con. 9, lines 1-13). 

As per claim 8, Hayman and Ayi teach all the claimed subject matters as 
discussed in claim 7, and further teach said each package further comprising including 
one or more administrative routines for defining a policy for the model set (Hayman, 
con. 9, line 55 - con. 10, line 4). 

As per claim 9, Hayman and Ayi teach all the claimed subject matters as 
discussed in claim 8, and further teach one or more administrative routines for defining 
a policy further comprising including one or more administrative routines for defining a 
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name for a particular policy; labels for the particular policy; descriptions for the labels; 
and properties for the labels (Hayrnan, con. 5, lines 18-60). 

As per claim 10, Hayrnan and Ayi teach all the claimed subject matters as 
discussed in claim 6, and further teach invoking an administrative routine of the first 
package for defining the first policy (Hayrnan, con. 5, lines 18-60). 

As per claim 1 1 , Hayrnan and Ayi teach all the claimed subject matters as 
discussed in claim 10, and further teach invoking the administrative routine of the first 
package further comprising providing to the administrative routine of the first package a 
plurality of parameters including a policy name for the first policy and a plurality of label 
names for labels of the first policy (Hayrnan, col. 5, lines 18-60, col. 6, lines 45-67). 

As per claim 12, Hayrnan and Ayi teach all the claimed subject matters as 
discussed in claim 6, and further teach in response to attempts to operate on data in a 
row in the table, the step of determining that the first policy applies to the table 
(Hayrnan, col. 5, lines 25-39, Ayi, page 1, [0006]-[00081). 

As per claim 13, Hayrnan and Ayi teach all the claimed subject matters as 
discussed in claim 6, and further teach associating a second policy of a second model 
set in a second package with a second table within the database system; and invoking 
the access mediation routine in the second package for determining whether to allow 
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operation on data in the second table based on the second policy (Ayi, page 1 , 
[0006]-[0008]). 

As per claim 14, Hayman and Ayi teach all the claimed subject matters as 
discussed in claim 13, and further teach the second model in the second package is the 
same as the first model in the first package (Hayman, col. 5, lines 25-60, Ayi, page 1, 
[0006]-[0008]). 

As per claim 15, Hayman and Ayi teach all the claimed subject matters as 
discussed in claim 13, and further teach the second model in the second package is 
different from the first model in the first package (Hayman, col. 5, lines 25-60, Ayi, page 
1, [0006]-[0008]). 

As per claim 16, Hayman and Ayi teach all the claimed subject matters as 
discussed in claim 13, and further teaches the second table is the same as the first 
table (Hayman, col. 5, lines 25-60, Ayi, page 1., [0006]-[0008]). 

As per claim 17, Hayman and Ayi teach all the claimed subject matters as 
discussed in claim 13, and further teach the second table is different from the first table 
(Hayman, Col. 5, lines 25-60, Ayi, page 1 , [0006]-[0008]). 
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As per claim 18, Hayman and Ayi teach all the claimed subject matters as 
discussed in claim 6, and further teach invoking the access mediation routine in the first 
package further, comprising providing data indicating the first policy to the access 
mediation routine (Hayman, Col. 9, line 55 - Col 10, line 4). 

As per claim 19, Hayman and Ayi teach all the claimed subject matters as 
discussed in claim 6, and further teach the method further comprises the step of 
determining a set of allowed labels for the first policy for a user of the database 
management system; said step of invoking the access mediation routine is performed 
during said step of determining the set of allowed labels; and the user is allowed to 
operate on the data according to the first policy if the data is associated with a label for 
the first policy and the label is included in the set of allowed labels for the first policy 
(Hayman, Col. 5, lines 25-60, col. 9, line 55 - Col. 10, line 4). 

As per claim 20, Hayman and Ayi teach all the claimed subject matters as 
discussed in claim 19, and further teach storing the set of allowed labels in a session 
cache for a communication session between the database management system and the 
user (Hayman, Col. 8, lines 54-67, Ayi, page 1, [0006H0008]). 

Claims 26-40 are rejected on grounds corresponding to the reasons given above 
for claims 6-20. 
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Response to Argument 

4. Applicant's arguments filed 1 5 December 2005 have been fully considered but 
they are not persuasive. 

The Declaration filed on 22 October 2004 under 37 CFR 1.131 has been 
considered but is ineffective to overcome the Ayi et al. ("Ayi") (Pub. No.: US 
200201 43735 A1 ) reference. 

The evidence submitted is insufficient to establish a reduction to practice of the 
invention in this country or a NAFTA or WTO member country prior to the effective date 
of the Ayi reference for the following reasons: 

1 ). the Declaration is not signed by all inventors. 

The Applicants' representative argued that his records, including 
acknowledgment receipt from the USPTO dated October 22, 2004, indicated that three 
Declarations under 37 CRF 1.131 were executed and mailed on October 18, 2004, each 
with a different inventor's signature. On contrary to his remarks, only one copy of the 
Declaration with Mr. Rae K. Burns' signature is recorded in USPTO system. 
Please send us evidence of postcard receipts along with copies of signed Declarations 
for the other two inventors: Mr. Patrick F. Sack and Mr. Vikram Reddy Pesati. 

2.) the Declaration does not contain a statement indicating whether the work 
is done in the US or member country. 
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3). the Declaration fails to properly show the reduction of practice prior the 
effective date of the reference because there was no discussion of claim language 
supported by the provided exhibits A-D. 

Based on the above reasons, the Declaration remains defective. 

Further, Applicants argue that Hayman reference does not discuss or teach that 
routines that are registered with the database management system. In response to the 
preceding arguments, Examiner respectfully submits that Hayman teaches the above 
limitation as incorporating their own software to change access mode of a user or 
administrator, or to process authentication transactions before allowing a user or 
administrator access t the system, in either an existing mode or a new mode 
implemented by the said software. After installation (i.e., registering with the database) 
of said new software, administration of the new access mode functions and/or the new 
authentication functions is accomplished in the same way as administration of the 
access modes and authentication methods delivered with the original security system 
(col. 9, lines 1-14). The above limitation has also been addressed from the previous 
office action dated October 1 , 2005. 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .136(a). 
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A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Leslie Wong whose telephone number is (571 ) 272- 
4120. The examiner can normally be reached on Monday to Friday 9:30am - 6:30 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, CHARLES RONES can be reached on (571) 272-4085. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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Primary Patent Examiner 
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